AGENTFORCE-AF-11: Agent Tool Writes to System of Record
🔴 High · MuleSoft Agent Fabric
Detects Mule MCP tools and A2A agents whose flows write to Jira, Workday, a database, ServiceNow, Salesforce, SAP, NetSuite or Dynamics and are reachable by an LLM (chosen by a broker LLM, or served without authentication). High; critical when the operation deletes or terminates records.
Details
| Field | Value |
|---|---|
| Rule ID | AGENTFORCE-AF-11 |
| Severity | High |
| Category | MuleSoft Agent Fabric |
Remediation
Narrow what the agent can do to the system of record: split read and write tools, run the write under a least-privilege integration user, validate inputs in the flow (allow-list record types and fields, require explicit ids), require approval before deletes (pending request instead of a direct delete), and authenticate the MCP / A2A server so only the intended broker can call it.